Differences

This shows you the differences between two versions of the page.

--- ldap_authentication [2009/02/19 13:52] – mediawiki_default
+++ ldap_authentication [2026/09/26 21:49] (current) – removed - external edit (Unknown date) 127.0.0.1
@@ Line 1: / Line 1: @@
-I found [[http://www.debian-administration.org/articles/585#NSS_configuration|this]] guide to be very useful as it lists answers to the debconf questions.  The only difference between the recommended configuration and tardis' is that "Local crypt to use when changing passwords." should be 'exop'.
-====== Getting user information from [[ldap]] ======
-The <code>libnss-ldap</code> package handles fetching account information from LDAP.
-Also make sure that <code>nscd</code> is installed, otherwise [[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=190072|bad things]] may happen.
-To tell <code>libnss-ldap</code> where to look, you need to edit
-the <code>/etc/libnss-ldap.conf</code>.  At the very least, you'll need to
-give the host and base (<code>dc=tardis,dc=ed,dc=ac,dc=uk</code>).
-To tell libc to use <code>libnss-ldap</code>, you need to amend the appropriate lines in <code>/etc/nsswitch.conf</code>:
-  passwd:         files ldap
-  group:          files ldap
-  shadow:         files ldap
-The other databases are best left alone; we don't bother putting host
-information or such like in LDAP because we don't see much benefit.
-The <code>getent</code> program is useful for testing.
-====== Authenticating with [[ldap]] ======
-The <code>libpam-ldap</code> package is used for authentication against LDAP.  You need to configure <code>/etc/pam_ldap.conf</code> along the same lines as <code>/etc/libnss_ldap.conf</code>.  A typical example is:
-  host piper
-  base dc=tardis,dc=ed,dc=ac,dc=uk
-  rootbinddn cn=admin,dc=tardis,dc=ed,dc=ac,dc=uk
-  ldap_version 3
-  # NSS lookups need to be restricted to the appropriate parts of the tree.
-  # If other lookups are added to /etc/nsswitch.conf, they need to be put
-  # here too.
-  nss_base_passwd ou=People,dc=tardis,dc=ed,dc=ac,dc=uk
-  nss_base_group   ou=Group,dc=tardis,dc=ed,dc=ac,dc=uk
-  nss_base_shadow ou=People,dc=tardis,dc=ed,dc=ac,dc=uk
-  # Use funky generic LDAP password changing.
-  pam_password exop
-PAM needs to be told to use <code>libpam-ldap</code>, as well as the normal authentication for <code>root</code>.  Canonical <code>/etc/pam.d/common-auth</code>:
-  # ** Use trick from /usr/share/doc/libpam-ldap/README.Debian
-  #
-  auth    [success=1 default=ignore]      pam_unix.so nullok_secure
-  auth    required                        pam_ldap.so use_first_pass
-  auth    required                        pam_permit.so
-Note the <code>use_first_pass</code> option.  Without it logins will ask for a password for pam_unix, then one for pam_ldap, and so on, causing every other attempt to enter your password to fail even when you get it right.  You need to set up <code>/etc/pam.d/common-account</code> in the same way.